Quantum anonymous voting with anonymity check 
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We propose a new protocol for quantum anonymous voting having serious advantages over the 
existing protocols: it protects both the voters from a curious tallyman and all the participants from 
a dishonest voter in unconditional way. The central idea of the protocol is that the ballots are given 
back to the voters after the voting process, which gives a possibility for two voters to check the 
anonymity of the vote counting process by preparing a special entangled state of two ballots. Any 
attempt of cheating from the side of the tallyman results in destroying the entanglement, which can 
be detected by the voters. 

PACS numbers: 03.67.-a, 03.67.Dd 



There is a general trend in the modern society to au- 
tomatization and computerization of nearly all aspects of 
social life, including such subtle area as voting procedure 
in various contexts: from state governmental elections to 
decision making in rather small groups like parliaments 
or councils. As a consequence, a number of protocols for 
electronic voting have been developed and successfully 
applied in the last decades [l[ . Since such protocols meet 
the information security problems of confidentiality, au- 
thentication and data integrity, they belong to the scope 
of the science of cryptography. In the modern electronic 
voting systems the information security is provided by 
means of public-key cryptography, guaranteeing secrecy 
under condition of limited computational resources of a 
potential adversary. With the advent of quantum com- 
puters this condition becomes impractical, thus inspir- 
ing interest in unconditionally secure voting schemes and 
protocols. One perspective way to this end is connected 
to using quantum systems as information carriers, which 
proved to be successful for the development of uncondi- 
tionally secure key distribution; the technology known as 
quantum key distribution Q has reached presently the 
level of commercial realizations. 

In the present work we propose a protocol of anony- 
mous binary- valued voting involving n persons (voters), 
each making a binary decision hi € {0, 1} and writing 
it on a ballot, and one person (tallyman) collecting the 
ballots and announcing the result s — J2i^i- The pro- 
posed protocol possesses two security properties. The 
first property is the " anonymity of voting" , meaning that 
the value of individual vote of the ith voter, hi, remains 
unknown to other voters, the tallyman, and any third 
party possibly monitoring the communication lines, un- 
less s = 0, s = n, min{s, n — s} voters cooperate, or 
the ith voter discloses his decision. The second property 
may be called "non-exaggeration" and means inability of 
a voter to contribute a number different from or 1 to the 
final sum s. The anonymity of voting protects the voters 
from a curious tallyman (and other parties), who may 
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wish to learn who voted in which way, while the non- 
exaggeration protects the entire community from mali- 
cious voters who may wish to vote twice. The proposed 
protocol includes operations with quantum systems and 
provides unconditional security for both anonymity and 
non-exaggeration, which distinguishes it from other exist- 
ing voting protocols, both quantum and classical, briefly 
reviewed below. 

There is a possibility of guaranteeing the anonymity 
of voting unconditionally by means of conventional, i.e. 
classical cryptography, based on mathematical encryp- 
tion. The corresponding voting protocol 0] is based on 
the principle of "sender untraceability" , meaning such 
a communication scheme, where the recipient of several 
messages from several senders cannot determine which 
message came from which sender. Such a communica- 
tion can be realized with unconditional security in the 
sense that the recipient is unable to establish any rela- 
tion between the messages and the senders, even being in 
possession of infinite computational power p|. However, 
the very property of untraceability creates, in the case 
of voting, an additional problem of determining which 
ballots come from legal voters, since illegal participants 
can send ballots in an untraceable way. This problem is 
solved by a special "ballot issuing" protocol (based on the 
technique of " blind signature" ) providing each legal voter 
with an " unforgeable" and "blind" digital ballot, which is 
used for sending a vote. The term "unforgeable" means 
that the ballot cannot be cloned, while the term "blind" 
means that the ballots are in no way related to the iden- 
tities of legal voters. The ballots in the ballot issuing 
protocol are unconditionally "blind" but only condition- 
ally " unforgeable" , that is a person in possession of rich 
enough computational power is able to vote instead of 
legal voters. Thus, the property of "non-exaggeration" 
is realized by the overall voting protocol in a conditional 
way only. 

A quantum protocol for anonymous surveying has been 
proposed recently, whose aim is to calculate the sum of 
individual contributions of the participants, like in the 
voting protocol, but with the contributions being real 
numbers from some limited interval rather than binary 
digits [f|. The protocol is based on bipartite entangled 



2 



quantum state, whose relative phase carries the sum of 
contributions and can be measured only when two parts 
of the entangled system are gathered in the same loca- 
tion. Application of this protocol to binary-valued vot- 
ing meets the problem of multiple voting by a dishonest 
voter, which is proposed to be solved by employing two 
non-cooperative ballot agents (tallymen). A similar pro- 
tocol for quantum voting has been proposed Q , meeting 
the same problem of multiple voting, and various ways for 
solving it have been discussed requiring also an employ- 
ment of two non-cooperative tallymen. Another similar 
quantum protocol based on multipartite entanglement 
and quantum Fourier transform has been proposed Q, 
which is also vulnerable to multiple voting and may be 
securely applied only under the assumption that the voter 
has no full control of the ballot at the time of writing the 
choice. All the mentioned quantum protocols provide 
unconditional anonymity of voting, but the property of 
" non-exaggeration" is reached on the cost of serious ad- 
ditional assumptions, which may be viewed impractical 
in some applications. In contrast, the present protocol 
provides in unconditional way both "eavesdropping de- 
tection" , meaning non-zero probability of detection of 
any attempt to learn the distribution of votes among the 
voters, and "non-exaggeration", thus protecting the pro- 
tocol from dishonest voters from one side and dishonest 
tallyman from the other side. Here we consider, like in 
Refs. jUSSH, a curious but not malicious tallyman, 
whose dishonest action is limited to learning the distri- 
bution of votes among the voters, but not to announcing 
a wrong value of the voting result s. 

The protocol of voting is as follows. The participants 
are n legal voters labelled by index i — 1,2, ...,n and a 
tallyman. 

1. Each voter chooses either to vote or to check the 
anonymity of voting. 

(a) In the case of voting the voter makes a bi- 
nary decision bi with bi = corresponding to 
"no" and bi = 1 corresponding to "yes" deci- 
sion, and encodes it into a state of a two-level 
quantum system - qubit - playing the role of 
a ballot. Two orthogonal states |0)i and 

of a qubit (computational basis) are used for 
encoding of the corresponding value of bi. 

(b) In the case of anonymity check the ith voter 
cooperates with the jth voter, who also 
chooses to check the anonymity, and they to- 
gether prepare their pair of qubits in the Bell 
state \^ + }ij, where the Bell states are defined 
as 

1$% = -^{lO^-ill}^}, (1) 
1*%- = -^{lO^-ill^O},}. (2) 

2. After the encoding all voters send their qubits to 
the tallyman together with their identities. The 



latter excludes the possibility of voting for illegal 
participants and the possibility for legal voters to 
vote instead of their colleagues. 

3. The tallyman collects all n qubits and calculates 
the number of "yes" votes by applying to the n- 
qubit system the projector valued measure (PVM) 

P(s)=Y J \m(s,7r))(m(s,n)\, (3) 

7T 

where |m(s, ir)) is a product state of n qubits in 
the computational basis, having exactly s l's in the 
order determined by the permutation variable ir. 
The tallyman announces the voting result "s votes 
yes". 

4. The tallyman sends the qubits back to the voters. 

5. The voters make a ballot test. 

(a) The voters, who have chosen to vote, measure 
their qubits in the computational basis. If the 
state of the qubit is different from the sent 
one, they state the ballot test failure. 

(b) The voters, who have chosen to make an 
anonymity check, make a measurement of 
their pair of qubits in the Bell basis. If they 
get a result which is different from the Bell 
state \*S> + )ij, they state the ballot test failure. 

A few comments to the protocol are necessary. In the 
present protocol the statement of the ballot test failure 
does not mean a public accusation of the tallyman, it is 
rather an information for the personal use by the voter 
(e.g. a council member). 

The numbering with n is as follows. All n-bit strings 
with exactly s l's represent numbers < m < (2™ — 1) 
in binary notation. Let us sort the strings in increasing 
order of the corresponding numbers m and label them 
with index 7r taking consecutive integer values from 1 to 
d s = (™) . In this way for any < s < n we get a set of 
strings m(s, 7r). The product state of n qubits in compu- 
tational basis with individual qubit states \bi)i, bi being 
ith bit from the string m(s, it), is the state \m(s, w)). For 
example, in the case of 5 qubits m(l,2) = 00010 and 
|m(l,2)) = |0) 5 |0) 4 |0) 3 |l)2|0)i. The states \m(s,n)) are 
mutually orthogonal. 

The projector given by Eq.([3]) is a projector on the 
subspace of n-qubit system, having s states |1) and n — s 
states |0). Let us denote this ^-dimensional subspace 
V s . It is easy to see, that the subspaces corresponding to 
different values of s are orthogonal and their sum is the 
entire state space of n qubits. The states |m(s,7r)) for 
given s form a basis in V s . The application of projective 
measurement Eq.Q corresponds to measuring the num- 
ber of "yes" votes, but not their distribution among the 
voters. 

Let us see how the protocol guarantees the anonymity 
of voting. Consider an event E(fi) consisting in 2k voters 
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choosing to check the anonymity, I voters voting "yes" 
and the rest voting "no". The state of n ballot qubits 
collected by the tallyman is represented by a state 

l^)) = 4f E Mk + l,n)), (4) 

where f2(/i) is a set of 2 k possible values of tt. The 
state Eq.(H]) belongs to the subspace Vf-+i and therefore 
is not affected by the projective measurement defined by 
Eq. ([3]) . In the absence of errors the qubits sent back to 
the voters will always pass the ballot test in the Step 5. 

Now we consider a curious tallyman, who makes an 
additional measurement of qubits with the aim to obtain 
some information on who voted which way. The simplest 
way to learn the vote of the ith voter is just to measure 
the ith qubit in computational basis. If the ith voter has 
chosen to vote, this attack passes unnoticed. But, if the 
ith voter has chosen to check the anonymity with the jth 
voter, their state will be transformed into |0)j|l)j 

or |l)j|0)j with equal probabilities, and the subsequent 
Bell measurement will give results or | 1 3 / ~)ij with 

probabilities |. The latter result means the anonymity 
check failure. Thus, a curious tallyman faces a risk of 
being detected. 

The possible attacks from a curious tallyman are in 
no way restricted to measurement of single qubits. The 
tallyman may wish to learn some partial information con- 
cerning the distribution of votes, for example, the total 
number of "yes" votes from a fraction of the voters. As 
it was mentioned above, we consider a curious but not 
malicious tallyman, who follows the protocol up to pro- 
jecting the qubits onto a subspace V a and correctly de- 
termining the value of s. After that the tallyman may be 
interested in making an additional measurement of the 
qubits. To prove the unconditional "eavesdropping de- 
tection" we need to show that for any such measurement 
there is an event E(fj,) for which the probability of ballot 
test failure is non-zero. 

The most general type of measurement on a system 
of n qubits, which we call "the object", consists in at- 
taching to them another quantum system of at least the 
same dimensionality (the measuring apparatus), making 
a unitary transformation Uoa of both the object and the 
apparatus, and analyzing the resulting state of the ap- 
paratus [9J. Since the states |m(s,7r)) for given s form a 
basis in V s , the unitary transformation can be determined 
by its action on the basis states: 

U A\m(s, n))o\ao)A = E l TO ( s ' ^oltw) A, (5) 

tt' 

where \clo)a is the initial state of the apparatus, and 
{o-tttt^a are its final states, generally not normalized. The 
subscripts O and A refer to the object and the apparatus 
respectively. Here we suggest that the measurement does 
not take the state of the qubits outside the subspace V s , 
because otherwise the non-zero probability of ballot test 



failure is obvious. Thus, all possible measurements of the 
tallyman are parameterized by a set of states {la^/)^}. 

To prove the property of "eavesdropping detection" of 
the proposed protocol, we need a result concerning the 
structure of strings m(s, tt) for given s. In the following 
we imply that s is fixed and the positions of bits in a 
string are numbered from right to left. 

Lemma. For given s and any two numbers 1 < tt, tt' < 
d S) the string m(s, tt') can be obtained from the string 
m{s, tt) by a finite number of pairwise permutations of Os 
and Is. 

Proof. Let w{s, tt, tt') be the set of positions of bits, which 
are different in m{s,ir) and m(s,Tr'). This set is a sum 
of two non-overlapping subsets: wq{s, tt, tt'), containing 
the positions of bits which are equal to in m(s, tt), 
and W\{s,tt ,tt'), containing the positions of bits which 
are equal to 1 in m(s,Tr). The lengths of the subsets 
Wo(s, tt, tt') and Wi(s, tt, tt') coincide, because the num- 
ber of Is in both strings is the same. Let us make a set 
of pairs wqi (s, tt, tt') of the elements of both subsets, tak- 
ing one position from wq(s, tt, tt') and one position from 
u>i(s, tt, tt') in increasing order. The string iti(s,tt) sub- 
jected to permutation of bits at positions defined by the 
set Wqi {s, tt, tt') gives the string m(s, tt'). □ 

Now we can proceed to proving the property of "eaves- 
dropping detection" of the proposed protocol, which is 
based on the following theorem. 

Theorem. For any measurement, defined by the appa- 
ratus states {\amri} a} , where is an event E(fj.) for which 
the probability of ballot test failure is non-zero, unless all 
the states satisfy 

\amr')A = |ail)A^7T7r', (6) 

i.e. no measurement is done. 

Proof. Let us suggest that the apparatus states contain a 
non-zero off-diagonal state |a WTr /)^, tt ^ tt' . Consider the 
event E(/j), where all voters have chosen to vote and the 
distribution of votes corresponds to the string m(s, tt). 
For this event the probability of ballot test failure is non- 
zero, because the qubits received by the voters are in a 
mixture having component \m(s,Tr')). 

Now let us consider measurements with the apparatus 
states satisfying 

{a-inr^A = \a-inr) aStttt' ■ (J) 

Consider any two values tt =/= tt' . Due to the Lemma the 
strings m(s, tt') and m(s, tt) differ by finite number k of 
pairwise permutations determined by the set of bit posi- 
tion pairs woi(s, tt, tt'). Consider the event E{v), where k 
pairs of voters, determined by wq\(s , tt , tt' ) , have chosen 
to check the anonymity, and the rest have voted in a way 
described by the coinciding bits of m(s,Tr') and m(s, tt). 
For this event the state of qubits before the measurement 
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is a superposition of 2 k states of the type of Eq.Q, in- 
cluding \m(s,n)} and \m(s,n')). After the interaction 
with the apparatus these two components get factors 
{a^) and la^'ir') respectively, as indicated by Eq.©, 
which leads to a non-zero probability of wrong result for 
Bell state measurement, unless | )• □ 

In summary, we have proposed a quantum protocol of 
voting, guaranteeing that each voter contributes only one 
vote and that any attempt of learning who voted which 
way is detectable with non-zero probability. The protocol 
is a cryptographic primitive, intended to be an element 
of a more complicated cryptographic system, providing 
complex security of voting, including, e.g. authentication 
of legal voters etc. The main weakness of the protocol is 
its inability to realize a guaranteed anonymity of a single 
voting act, providing only the probabilistic "eavesdrop- 



ping detection" , which is useful for application to many 
voting acts during a rather long period. Another weak- 
ness is connected to the necessity of cooperation of voters 
having opposite decisions, i.e. most probably, belonging 
to different fractions. However, to our knowledge, it is 
the first voting protocol uniting the protection of the vot- 
ers from a dishonest tallyman and the protection of the 
participants from a dishonest voter in unconditional way. 



Acknowledgments 

This work was supported by the project EQUIND per- 
formed within the 6 th Framework programme of Euro- 
pean Commission. 



[1] Secure Electronic Voting, ed. by D. Gritzalis (Kluwer, 
2003). 

[2] S. Ya. Kilin, in Progress in Optics, ed. E. Wolf, 42, 1 
(2001). 

[3] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. 
Mod. Phys. 74, 145 (2002). 

[4] D. Chaum, in Advances in Cryptology: EuroCrypt '88 
Proceedings, edited by C. G. Giinther, Lecture Notes in 
Computer Science (Springer- Verlag, Berlin), 434, 177-182 



(1988). 

[5] D. Chaum, J. Cryptology 1, 65 (1988). 
[6] J. A. Vaccaro, J. Spring, and A. Chefles, Phys. Rev. A 75, 
012333 (2007). 

[7] M. Hillery, M. Ziman, V. Buzek, M. Bielikova, Phys. Lett. 

A 349, 75 (2006). 
[8] S. Dolev, I. Pitowski, B. Tamir, [qua"nt-ph/0602087] (2006) . 
[9] E. P. Wigner, Am. J. Phys. 31, 6{T963). 



